Functions editing in Sentinel/Log Analytics doesn't work anymore

Question

Functions editing in Sentinel/Log Analytics doesn't work anymore

Daniele Leopizzi 0

When I select "load code to editor" to edit a workspace function in Sentinel/LogAnalytics, the code isn't loaded in a new dedicated tab, but in the current one and treated as brand new code, that I can only save as a new function.

This way I can't modify any existing workspace function, but only create new ones.

I've been observing this behavior since last Monday (July 27th)

0 comments

3 answers

Your answer

Answer 1

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Answer 2

Hi @Daniele Leopizzi

This is not the expected behaviour. When Load function code is selected for an existing workspace function, the function name should appear in the editor tab and the Save option should allow the existing function to be updated. Save as function is intended for creating a new function

First, please confirm that your account has the Log Analytics Contributor role, or the Microsoft.OperationalInsights/workspaces/savedSearches/write permission.

If the permissions are correct and the same issue occurs in another browser or private session, this is likely a portal UI regression. As a temporary workaround, the existing function can be updated through Azure CLI:

az monitor log-analytics workspace saved-search update \

--resource-group "<resource-group>" \

--workspace-name "<workspace-name>" \

--name "<saved-search-resource-name>" \

--saved-query "<updated-KQL-query>"

Answer 3

Daniele Leopizzi 0

Hi @Konstantinos Lianos ,

Thank you for your reply.

Following your suggestion, I also tried using a different browser, but the issue persists.

Furthermore, this morning I encountered the same issue on another Azure subscription, where the “load to editor” command had been working perfectly just an hour earlier.

I’ll try using the CLI, as you suggested, and let you know how it goes.

Konstantinos Lianos 830 Reputation points Student Ambassador

2026-08-05T10:23:20.5833333+00:00

Nice!
David Alejandro Peñaloza Farias 20 Reputation points

2026-08-06T20:24:08.68+00:00
I am experiencing the same issue in Log Analytics.

Since August 6, 2026, the Functions panel no longer shows the “Group by legacy category” option. It now only shows Category and Solution, and the custom categories previously assigned to our workspace functions are no longer displayed correctly.

I am also unable to edit an existing function. When I select Load to editor, the KQL code is copied into a new query tab, but the tab remains associated with New query instead of the original function. As a result, the Save menu only offers Save as function, rather than updating the existing function.

I reproduced the issue in:

Different browsers

Incognito/InPrivate mode

A completely empty query tab

My assigned role includes:

Microsoft.OperationalInsights/workspaces/savedSearches/*

Therefore, this does not appear to be a permissions or browser-cache issue. It seems to be related to a recent change or regression in the Azure Portal Log Analytics interface.

Could Microsoft please confirm whether this is a known issue and whether the existing function categories are still preserved in the backend? At the moment, we cannot properly group or edit our workspace functions through the portal.